CVE-2023-4933

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The WP Job Openings WordPress plugin before 3.4.3 does not block listing the contents of the directories where it stores attachments to job applications, allowing unauthenticated visitors to list and download private attachments if the autoindex feature of the web server is enabled.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-552

Affected software

Vendor	Product	Versions
Unknown	WP Job Openings	< 3.4.3

References

https://wpscan.com/vulnerability/882f6c36-44c6-4273-81cd-2eaaf5e81fa7Exploit, Third Party Advisory
https://wpscan.com/vulnerability/882f6c36-44c6-4273-81cd-2eaaf5e81fa7Exploit, Third Party Advisory

Timeline

Published: Oct 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-493308.8Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while getting aggregate report data.CVE-2023-493318.8Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the aggregate reports search option.CVE-2023-493328.8Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while adding file shares.CVE-2023-493338.8Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the dashboard graph feature.CVE-2023-493348.8Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report.CVE-2023-493358.8Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while getting file server details.CVE-2023-493374.8Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. (8.5 and earlier are unaffected.)CVE-2023-493387.5Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8 CVE-2023-493396.5Ellucian Banner 9.17 allows Insecure Direct Object Reference (IDOR) via a modified bannerId to the /StudentSelfService/ssb/studentCard/retri CVE-2023-49348.8Authorization Bypass Through User-Controlled Key vulnerability in Usta AYBS allows Authentication Abuse, Authentication Bypass. This issue CVE-2023-493409.8An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011, allows remote attackers to escalate privileg CVE-2023-493417.5An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011, allows remote attackers to obtain sensitive